Splunk F5 for Networks Question

[gnovak]

I installed the Splunk for F5 networks on an indexer that only has network data. So far the data we have is:

pix
asa
f5
switch
iostat

I'm trying to get this app to work but i can't find a manual on this app anywhere. I noticed other posts that said you have to have your sourcetype be "F5_SPLUNK_iRULE".

What source has to have this sourcetype? F5 logs only? Pix logs?

Also, since I already have my network logs assigned sourcetypes (which i listed above) can I make a secondary sourcetype as well for these logs?

I'd really like to utilize this app but the fact there rare no instructions for this is really discouraging.

[MarioM · Accepted solution]

The Splunk for F5 Networks is based on f5 ltm traffic which is not logged in default syslog and need irule to get it logged to remote syslog.

The instructions are inside the app as well as the iRule:

splunk/etc/apps/SplunkforF5Networks/Installing Splunk for F5 Big.pdf

splunk/etc/apps/SplunkforF5Networks/irule.txt

Regarding the sourcetype you can use: Manager » Fields » Sourcetype renaming to rename the existing sourcetype.

Sourcetypes to work with different app

F5 LTM default syslog > ltm_log

F5 LTM Traffic log generated by iRule > F5_SPLUNK_iRULE

Splunk for Cisco firewall add-on > cisco_asa, cisco_pix

[gnovak]

Thanks for the info!